Are you Denied Access to Any Website or Internet?

Denial of service Attacks

• Make a device dysfunctional. This is done by deleting or changing configurations of the device or by power interruptions.
• Make a device overwhelmed by bogus service requests such that it is unable to function properly. This is more an attack on the computational resource of a device or system. By overloading this resource it cause degradation of service to a point where the device/system crashes.
• Consume the network bandwidth by flooding a system.
• Nuke attack uses a modified ping utility to continually send fragmented data (ICMP packets) to the target slowing down the affected computer. Nuke attacks also refer to sending continuous messages in instant messenger or online gaming. Techniques have been put into place to stop third party flood control.
• Win Nuke is a remote denial of service affecting Windows 95, NT and 3.1X operating systems. The exploit is an out of band data to the target computer causing the blue screen of death.
• Ping of Death is sending a malicious ping to a computer system. Ping is usually 64 bytes in size. Sending a ping with size more than 64 bytes crashes the system due to buffer overflow that occurs at time of reassembling the packet. This is called ping of death and is an exploit of the past since remedial measures have been implemented in systems and devices affected like UNIX, Linux, Mac, Windows, Printers and Routers. 

Tools for DoS Attacks

• Ping flooding is another wide spread technique of flooding the system with ping so that normal traffic does not reach the system.
• Smurf uses spoofed broadcast ping messages in its denial of service attack. A large amount of ICMP echo (ping) traffic is sent to the target IP address. On a multi-access broadcast network many machines may reply to each packet causing flooding. Using a secure Router and proper configuration mitigates this problem.
• UDP flood attack is done by sending a large number of UDP packets to random ports. If no application listens at that port the machine replies with an ICMP; destination unreachable packet. For large number of packets with spoofed addresses the victims computational resources are affected thereby slowing traffic on the network and reducing bandwidth.
• LAND attack sends a spoofed TCP SYN packet to the targets IP address. The packets source and destination address is the same as that of the targets IP address. This causes the machine to reply to itself continuously. It is a security flaw discovered in Windows Server 2003 and Windows XP. Other services that have been LAND attacked are SNMP, Windows 88/TCP Kerberos, and chargen port on a UNIX system. This is also called a banana attack where outgoing messages are redirected to the client itself.
• Tear drop is a remote denial of service by sending IP fragments with overlapping payload. When reassembling is done the operating system crashed due to a bug.
• SPAM is Denial of Service too and is limited to your mail box.

Distributed Denial of service attacks

Distributed reflected denial of service

How to Prevent Denial of Service Attacks

• Implement service packs and patches as and when it is available
• Configure all your ports properly by disabling any port or network service you are not using. This limits the ability of the intruder.
• Enable quota system if your operating system supports it. It helps in keeping critical files and other resources out of other users’ access.
• Observe the system performance and be more aware of speed of working and internet to be able to determine if anything is slowing down your system.
• In case of large networks examine the physical security of your devices in addition to network security.
• Use tools that notify you about changes in configuration or changes in other files
• Maintain proper password policies.
• Firewalls and access policies may help you to some extent but cannot prevent an all out attack. Modern inspection firewalls and routers like checkpoint FW1 NGX and Cisco PIX are made to differentiate good and bad traffic and can help in prevention of a DoS attack.
• The best method to prevent DoS and DDoS is tracking down and shutting down botnets.